Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2024 11:21

General

  • Target

    49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

  • Size

    50KB

  • MD5

    d08c6251a4242a295b2b12f099d11670

  • SHA1

    11c079d31ebf1732fbe65f83a0be15202478967f

  • SHA256

    49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6

  • SHA512

    ba74639a5e7ae6add2a28ab4c15067ce77f241805a102356759bc1fbb032f89c56bfb44c9d7cdcbfcc1782d64e012859b10559d7e8b81aab894e6cc66fd2ddce

  • SSDEEP

    1536:0Q1Zw+K5/jjV6wTO+bOekp4G60r0MOT/LgF:e5bjMz+bOIA/OTTgF

Malware Config

Extracted

Family

xworm

C2

24.ip.gl.ply.gg:12722

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe
    "C:\Users\Admin\AppData\Local\Temp\49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    847c37fabda84b5de95e270b1333888d

    SHA1

    27a8be6dfe848954d380b2fac12cbed094b48a19

    SHA256

    9cb0e0eb3c5c8a9b4a42cc7cb646a5bad78a609a6e338a7c03e89d9abae6fb23

    SHA512

    497c149d476a4ebb182428b7cf61715e560f9cda2a9d6f0fba440c11f03f57a0bac2fd6969b25c727f845f21d53e2850dcdc936cf88f5ba1d384b5641f9cafe9

  • memory/2716-6-0x0000000002C20000-0x0000000002CA0000-memory.dmp

    Filesize

    512KB

  • memory/2716-7-0x000000001B730000-0x000000001BA12000-memory.dmp

    Filesize

    2.9MB

  • memory/2716-8-0x0000000001D70000-0x0000000001D78000-memory.dmp

    Filesize

    32KB

  • memory/2900-14-0x000000001B5A0000-0x000000001B882000-memory.dmp

    Filesize

    2.9MB

  • memory/2900-15-0x0000000002790000-0x0000000002798000-memory.dmp

    Filesize

    32KB

  • memory/2980-0-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

    Filesize

    4KB

  • memory/2980-1-0x0000000001210000-0x0000000001222000-memory.dmp

    Filesize

    72KB

  • memory/2980-31-0x000000001B0D0000-0x000000001B150000-memory.dmp

    Filesize

    512KB

  • memory/2980-32-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

    Filesize

    4KB

  • memory/2980-33-0x000000001B0D0000-0x000000001B150000-memory.dmp

    Filesize

    512KB